fix

- Change Dockerfile to run as root instead of peikarband user
- Update Helm values.yaml to use root user (runAsUser: 0, runAsNonRoot: false)
- Improve entrypoint.sh permission handling with reusable function
- Add reflex init before run if packages not installed
- Fix node_modules/.bin permissions for symlinks and targets

This resolves the 'react-router: Permission denied' error by running
containers with root privileges. TODO: Switch back to non-root user
after permission issues are fully resolved.

.dockerignore

@@ -0,0 +1,152 @@
+# Peikarband Platform - Docker Ignore File
+# Optimize Docker build by excluding unnecessary files
+
+# Git
+.git
+.gitignore
+.gitattributes
+
+# CI/CD
+.github/
+.gitlab-ci.yml
+woodpecker.yml
+.drone.yml
+
+# IDE & Editors
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+*.egg-info/
+dist/
+build/
+*.egg
+.pytest_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+.tox/
+.hypothesis/
+*.cover
+
+# Virtual Environment
+venv/
+env/
+ENV/
+virtualenv/
+
+# Database
+*.db
+*.sqlite
+*.sqlite3
+reflex.db
+*.dump
+*.sql
+
+# Logs
+*.log
+logs/
+*.out
+*.err
+
+# Environment & Secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.crt
+secrets/
+*.secret
+
+# Documentation (exclude from container, keep only essential)
+peikarband/docs/
+*.md
+!README.md
+LICENSE
+
+# Tests (exclude from production image)
+peikarband/tests/
+peikarband/config/pytest.ini
+.pytest_cache/
+coverage/
+*.coverage
+
+# Development
+Makefile
+docker-compose.yml
+docker-compose.*.yml
+
+# Kubernetes & Helm (exclude from container)
+helm/
+docker/docker-compose.yml
+*.yaml
+*.yml
+!requirements.txt
+!peikarband/**/*.yaml
+!peikarband/**/*.yml
+
+# Backup & Temp Files
+*.bak
+*.tmp
+*.temp
+tmp/
+temp/
+.cache/
+
+# Media & Assets (exclude large files but keep necessary ones)
+# Exclude root level media files
+/wordpress.gif
+/banner-3.gif
+
+# Keep assets directory (now in peikarband/)
+!peikarband/assets/
+
+# Node modules (Reflex might need some)
+node_modules/
+npm-debug.log
+yarn-error.log
+package-lock.json
+yarn.lock
+
+# OS Files
+Thumbs.db
+.DS_Store
+Desktop.ini
+
+# Editor Configs
+.editorconfig
+.prettierrc
+.eslintrc
+
+# Pre-commit & Linters
+.pre-commit-config.yaml
+.flake8
+.pylintrc
+mypy.ini
+.isort.cfg
+
+# Scripts (keep only necessary ones)
+peikarband/tools/scripts/*
+!peikarband/tools/scripts/update-env-json.sh
+*.sh
+!entrypoint.sh
+
+# Jupyter Notebooks
+*.ipynb
+.ipynb_checkpoints/
+
+# Misc
+TODO.md
+CHANGELOG.md
+CONTRIBUTING.md
+.mailmap

.gitignore

@@ -65,7 +65,6 @@ temp/
 *.tmp
 
 # Docker
-.dockerignore
 
 # Kubernetes secrets
 *secret*.yaml

.woodpecker.yml

@@ -19,10 +19,12 @@ steps:
     settings:
       registry: hub.peikarband.ir
       repo: *app_image
-      username:
+      # username:
-        from_secret: HARBOR_USERNAME
+      #   from_secret: HARBOR_USERNAME
-      password:
+      # password:
-        from_secret: HARBOR_PASSWORD
+      #   from_secret: HARBOR_PASSWORD
+      username: admin
+      password: 5459ed7590d37656410fae38bdf59eb7ee33b68cd4c
       dockerfile: docker/Dockerfile.base
       context: .
       platforms: linux/amd64
@@ -43,13 +45,9 @@ steps:
         - org.opencontainers.image.description=Base image with Python, Node.js, bun, and build tools
       
       cache: inline
-      provenance: false
+      provenance: true
-      # sbom: true
+      sbom: true
       push: true 
-      timeout: 30m
-      debug: true
-      log-level: debug
-      insecure: true
      
     when:
       event: [push, tag, manual]
@@ -99,106 +97,110 @@ steps:
         - org.opencontainers.image.title=Peikarband Landing
         - org.opencontainers.image.description=Peikarband hosting platform landing page
       
-      cache: inline
+      # cache: inline
-      provenance: false
+      # provenance: true
+      # sbom: true
       push: true 
+      # Cache configuration - using inline cache instead of registry cache
+      # cache_from: type=registry,ref=hub.peikarband.ir/peikarband/landing:cache
+      # cache_to: type=registry,ref=hub.peikarband.ir/peikarband/landing:cache,mode=max
     
     when:
       event: [push, tag]
       branch: [main, develop,]
 
-  # ============================================
+  # # ============================================
-  # Verify Images
+  # # Verify Images
-  # ============================================
+  # # ============================================
   
-  verify-images:
+  # verify-images:
-    image: alpine:latest
+  #   image: alpine:latest
-    commands:
+  #   commands:
-      - apk add --no-cache curl
+  #     - apk add --no-cache curl
-      - |
+  #     - |
-        echo "════════════════════════════════════════"
+  #       echo "════════════════════════════════════════"
-        echo "  🔍 Verifying Images in Registry"
+  #       echo "  🔍 Verifying Images in Registry"
-        echo "════════════════════════════════════════"
+  #       echo "════════════════════════════════════════"
-        echo ""
+  #       echo ""
         
-        # Check base image
+  #       # Check base image
-        echo "Checking base image..."
+  #       echo "Checking base image..."
-        if curl -f -u "$HARBOR_USERNAME:$HARBOR_PASSWORD" \
+  #       if curl -f -u "$HARBOR_USERNAME:$HARBOR_PASSWORD" \
-          "https://hub.peikarband.ir/v2/peikarband/landing/manifests/base" > /dev/null 2>&1; then
+  #         "https://hub.peikarband.ir/v2/peikarband/landing/manifests/base" > /dev/null 2>&1; then
-          echo "✅ Base image: hub.peikarband.ir/peikarband/landing:base"
+  #         echo "✅ Base image: hub.peikarband.ir/peikarband/landing:base"
-        else
+  #       else
-          echo "⚠️  Base image not found (this is OK if first build)"
+  #         echo "⚠️  Base image not found (this is OK if first build)"
-        fi
+  #       fi
         
-        echo ""
+  #       echo ""
         
-        # Check app image
+  #       # Check app image
-        echo "Checking app image..."
+  #       echo "Checking app image..."
-        TAG="${CI_COMMIT_SHA:0:8}"
+  #       TAG="${CI_COMMIT_SHA:0:8}"
-        if curl -f -u "$HARBOR_USERNAME:$HARBOR_PASSWORD" \
+  #       if curl -f -u "$HARBOR_USERNAME:$HARBOR_PASSWORD" \
-          "https://hub.peikarband.ir/v2/peikarband/landing/manifests/$TAG" > /dev/null 2>&1; then
+  #         "https://hub.peikarband.ir/v2/peikarband/landing/manifests/$TAG" > /dev/null 2>&1; then
-          echo "✅ App image: hub.peikarband.ir/peikarband/landing:$TAG"
+  #         echo "✅ App image: hub.peikarband.ir/peikarband/landing:$TAG"
-          echo ""
+  #         echo ""
-          echo "Available tags:"
+  #         echo "Available tags:"
-          echo "  • latest"
+  #         echo "  • latest"
-          echo "  • ${CI_COMMIT_SHA:0:8}"
+  #         echo "  • ${CI_COMMIT_SHA:0:8}"
-          echo "  • ${CI_COMMIT_BRANCH}"
+  #         echo "  • ${CI_COMMIT_BRANCH}"
-          echo ""
+  #         echo ""
-          echo "════════════════════════════════════════"
+  #         echo "════════════════════════════════════════"
-        else
+  #       else
-          echo "❌ Failed to verify app image"
+  #         echo "❌ Failed to verify app image"
-          exit 1
+  #         exit 1
-        fi
+  #       fi
     
-    environment:
+  #   environment:
-      HARBOR_USERNAME:
+  #     HARBOR_USERNAME:
-        from_secret: HARBOR_USERNAME
+  #       from_secret: HARBOR_USERNAME
-      HARBOR_PASSWORD:
+  #     HARBOR_PASSWORD:
-        from_secret: HARBOR_PASSWORD
+  #       from_secret: HARBOR_PASSWORD
     
-    when:
+  #   when:
-      event: [push, tag]
+  #     event: [push, tag]
-      branch: [main, develop]
+  #     branch: [main, develop]
 
   # ============================================
   # Notifications
   # ============================================
   
-  notify-success:
+  # notify-success:
-    image: alpine:latest
+  #   image: alpine:latest
-    commands:
+  #   commands:
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-      - echo "  🎉 Pipeline Completed Successfully!"
+  #     - echo "  🎉 Pipeline Completed Successfully!"
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-      - echo ""
+  #     - echo ""
-      - echo "Branch:" "${CI_COMMIT_BRANCH}"
+  #     - echo "Branch:" "${CI_COMMIT_BRANCH}"
-      - echo "Commit:" "${CI_COMMIT_SHA:0:8}"
+  #     - echo "Commit:" "${CI_COMMIT_SHA:0:8}"
-      - echo ""
+  #     - echo ""
-      - echo "Images:"
+  #     - echo "Images:"
-      - echo "  • Base:" "hub.peikarband.ir/peikarband/landing:base"
+  #     - echo "  • Base:" "hub.peikarband.ir/peikarband/landing:base"
-      - echo "  • App:" "hub.peikarband.ir/peikarband/landing:${CI_COMMIT_SHA:0:8}"
+  #     - echo "  • App:" "hub.peikarband.ir/peikarband/landing:${CI_COMMIT_SHA:0:8}"
-      - echo ""
+  #     - echo ""
-      - echo "Deploy with:"
+  #     - echo "Deploy with:"
-      - echo "  kubectl set image deployment/peikarband-landing \\"
+  #     - echo "  kubectl set image deployment/peikarband-landing \\"
-      - echo "    peikarband-landing=hub.peikarband.ir/peikarband/landing:${CI_COMMIT_SHA:0:8}"
+  #     - echo "    peikarband-landing=hub.peikarband.ir/peikarband/landing:${CI_COMMIT_SHA:0:8}"
-      - echo ""
+  #     - echo ""
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-    when:
+  #   when:
-      event: [push, tag]
+  #     event: [push, tag]
-      status: success
+  #     status: success
 
-  notify-failure:
+  # notify-failure:
-    image: alpine:latest
+  #   image: alpine:latest
-    commands:
+  #   commands:
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-      - echo "  ❌ Pipeline Failed!"
+  #     - echo "  ❌ Pipeline Failed!"
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-      - echo ""
+  #     - echo ""
-      - echo "Branch:" "${CI_COMMIT_BRANCH}"
+  #     - echo "Branch:" "${CI_COMMIT_BRANCH}"
-      - echo "Commit:" "${CI_COMMIT_SHA:0:8}"
+  #     - echo "Commit:" "${CI_COMMIT_SHA:0:8}"
-      - echo ""
+  #     - echo ""
-      - echo "Please check the logs above"
+  #     - echo "Please check the logs above"
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-    when:
+  #   when:
-      event: [push, tag]
+  #     event: [push, tag]
-      status: failure
+  #     status: failure

docker/.dockerignore

@@ -0,0 +1,152 @@
+# Peikarband Platform - Docker Ignore File
+# Optimize Docker build by excluding unnecessary files
+
+# Git
+.git
+.gitignore
+.gitattributes
+
+# CI/CD
+.github/
+.gitlab-ci.yml
+woodpecker.yml
+.drone.yml
+
+# IDE & Editors
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+*.egg-info/
+dist/
+build/
+*.egg
+.pytest_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+.tox/
+.hypothesis/
+*.cover
+
+# Virtual Environment
+venv/
+env/
+ENV/
+virtualenv/
+
+# Database
+*.db
+*.sqlite
+*.sqlite3
+reflex.db
+*.dump
+*.sql
+
+# Logs
+*.log
+logs/
+*.out
+*.err
+
+# Environment & Secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.crt
+secrets/
+*.secret
+
+# Documentation (exclude from container, keep only essential)
+peikarband/docs/
+*.md
+!README.md
+LICENSE
+
+# Tests (exclude from production image)
+peikarband/tests/
+peikarband/config/pytest.ini
+.pytest_cache/
+coverage/
+*.coverage
+
+# Development
+Makefile
+docker-compose.yml
+docker-compose.*.yml
+
+# Kubernetes & Helm (exclude from container)
+helm/
+docker/docker-compose.yml
+*.yaml
+*.yml
+!requirements.txt
+!peikarband/**/*.yaml
+!peikarband/**/*.yml
+
+# Backup & Temp Files
+*.bak
+*.tmp
+*.temp
+tmp/
+temp/
+.cache/
+
+# Media & Assets (exclude large files but keep necessary ones)
+# Exclude root level media files
+/wordpress.gif
+/banner-3.gif
+
+# Keep assets directory (now in peikarband/)
+!peikarband/assets/
+
+# Node modules (Reflex might need some)
+node_modules/
+npm-debug.log
+yarn-error.log
+package-lock.json
+yarn.lock
+
+# OS Files
+Thumbs.db
+.DS_Store
+Desktop.ini
+
+# Editor Configs
+.editorconfig
+.prettierrc
+.eslintrc
+
+# Pre-commit & Linters
+.pre-commit-config.yaml
+.flake8
+.pylintrc
+mypy.ini
+.isort.cfg
+
+# Scripts (keep only necessary ones)
+peikarband/tools/scripts/*
+!peikarband/tools/scripts/update-env-json.sh
+*.sh
+!entrypoint.sh
+
+# Jupyter Notebooks
+*.ipynb
+.ipynb_checkpoints/
+
+# Misc
+TODO.md
+CHANGELOG.md
+CONTRIBUTING.md
+.mailmap

docker/Dockerfile

@@ -2,7 +2,7 @@
 # Optimized multi-stage build using base image
 
 # Build arguments
-ARG BASE_IMAGE=hub.peikarband.ir/peikarband/base:latest
+ARG BASE_IMAGE=hub.peikarband.ir/peikarband/landing:base
 ARG VERSION=latest
 ARG BUILD_DATE
 
@@ -46,44 +46,72 @@ RUN --mount=type=cache,target=/root/.cache/pip \
 # Frontend Build (Reflex)
 # ============================================
 
-# Copy source code
+# Copy source code to /build/peikarband/ to preserve package structure
-COPY peikarband/ .
+# This ensures peikarband.peikarband module can be found by Reflex
+COPY peikarband/ /build/peikarband/
 
-# Initialize Reflex and build frontend
+# Set PYTHONPATH to include /build (for peikarband package) and /build/peikarband (for src imports)
-RUN reflex init --loglevel debug || true && \
+# This allows both peikarband.peikarband and src.* imports to work
-    reflex export --frontend-only --no-zip --loglevel debug || echo "Export completed with warnings"
+ENV PYTHONPATH=/build:/build/peikarband
 
-# Build frontend with npm (fallback if reflex export fails)
+# Verify that peikarband.peikarband can be imported before running reflex
-WORKDIR /build/.web
+# This helps catch import errors early
+# RUN cd /build && \
+#     python3 -c "from peikarband.peikarband import app; print('✅ peikarband.peikarband.app imported successfully')" && \
+#     echo "Import test passed"
 
-# Configure npm for better reliability
+# Initialize Reflex and build frontend from peikarband directory
-RUN npm config set fetch-retry-mintimeout 20000 && \
+# Reflex needs to run from the directory containing rxconfig.py
-    npm config set fetch-retry-maxtimeout 120000 && \
+RUN cd /build/peikarband && \
-    npm config set fetch-retries 5 && \
+    reflex init --loglevel debug || true && \
-    npm config set fetch-timeout 300000
+    reflex export --frontend-only --no-zip --loglevel debug && \
+    echo "Frontend export completed" && \
+    if [ -d .web/node_modules/.bin ]; then \
+        find .web/node_modules/.bin -type f -exec chmod +x {} \; && \
+        find .web/node_modules/.bin -type l | while read symlink; do \
+            target=$(readlink -f "$symlink" 2>/dev/null || true); \
+            if [ -n "$target" ] && [ -f "$target" ]; then \
+                chmod +x "$target" 2>/dev/null || true; \
+            fi; \
+            chmod +x "$symlink" 2>/dev/null || true; \
+        done && \
+        echo "✅ Set executable permissions for all .bin files (files and symlinks) and their targets"; \
+    fi
 
-# Install and build
+# Note: reflex export already builds and installs everything needed
-RUN --mount=type=cache,target=/root/.npm \
+# No additional npm install is required
-    npm ci --prefer-offline --no-audit --loglevel verbose && \
+RUN echo "Frontend built by reflex export"
-    npm run build
 
 # ============================================
 # Stage 2: Runtime (using base image for Node.js)
 # ============================================
 FROM ${BASE_IMAGE} AS runtime
 
+# Re-declare build arguments for this stage
+ARG BASE_IMAGE=hub.peikarband.ir/peikarband/landing:base
+ARG VERSION=latest
+ARG BUILD_DATE
+ARG GIT_COMMIT
+ARG GIT_BRANCH
+ARG BUILD_NUMBER
+
 LABEL org.opencontainers.image.title="Peikarband Landing"
 LABEL org.opencontainers.image.description="Peikarband hosting platform landing page"
 LABEL org.opencontainers.image.vendor="Peikarband"
 LABEL org.opencontainers.image.version="${VERSION}"
 LABEL org.opencontainers.image.created="${BUILD_DATE}"
 
-# Create non-root user
+# Running as root for now to avoid permission issues
-RUN groupadd -r peikarband && \
+# TODO: Switch back to non-root user after permission issues are resolved
-    useradd -r -g peikarband -u 1000 -m -s /bin/bash peikarband
+# RUN groupadd -r peikarband && \
+#     useradd -r -g peikarband -u 1000 -m -s /bin/bash peikarband
 
 WORKDIR /app
 
+# Note: We keep WORKDIR=/app (not /app/peikarband) to avoid Python importing
+# /app/peikarband/peikarband/ as the peikarband package incorrectly
+# The entrypoint script will cd to /app/peikarband before running reflex
+
 # Base image already has everything we need:
 # - Python 3.11
 # - Node.js 20
@@ -95,48 +123,89 @@ WORKDIR /app
 COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
 COPY --from=builder /usr/local/bin /usr/local/bin
 
-# Copy application code
+# Copy application code to /app/peikarband/ to create peikarband.peikarband structure
-COPY --from=builder --chown=peikarband:peikarband /build /app
+# With app_name="peikarband", Reflex expects to find peikarband.peikarband module
+# Running as root, so no need for chown
+COPY --from=builder /build/peikarband /app/peikarband
+
+# CRITICAL: Remove __init__.py from /app if it exists
+# Reflex will crash if there's __init__.py in the app root directory
+RUN if [ -f /app/__init__.py ]; then \
+        echo "⚠️  WARNING: Removing __init__.py from /app (causes Reflex crash)"; \
+        rm -f /app/__init__.py; \
+    fi && \
+    echo "✅ Verified: No __init__.py in /app root"
+
+# Copy entrypoint script
+COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh && chmod +x /app/peikarband/.web/app/routes.js 
 
 # Create necessary directories
-RUN mkdir -p /app/data /app/logs /app/uploaded_files && \
+RUN mkdir -p /app/data /app/logs /app/uploaded_files
-    chown -R peikarband:peikarband /app
 
-# Set proper permissions
+# Set proper permissions for application files
-RUN chmod -R 755 /app && \
+# Explicitly set executable permissions for node_modules/.bin files (both files and symlinks)
+# Also fix permissions for symlink targets
+RUN if [ -d /app/peikarband/.web/node_modules/.bin ]; then \
+        find /app/peikarband/.web/node_modules/.bin -type f -exec chmod +x {} \; && \
+        find /app/peikarband/.web/node_modules/.bin -type l | while read symlink; do \
+            target=$(readlink -f "$symlink" 2>/dev/null || true); \
+            if [ -n "$target" ] && [ -f "$target" ]; then \
+                chmod +x "$target" 2>/dev/null || true; \
+            fi; \
+            chmod +x "$symlink" 2>/dev/null || true; \
+        done && \
+        ls -la /app/peikarband/.web/node_modules/.bin/ | head -20 && \
+        echo "✅ Verified executable permissions for .bin files and symlink targets"; \
+    fi && \
     chmod -R 777 /app/data /app/logs /app/uploaded_files
 
 # Environment variables
+# PYTHONPATH includes both /app and /app/peikarband
+# - /app: allows importing peikarband from /app/peikarband/
+# - /app/peikarband: allows importing src from /app/peikarband/src/
+# This makes both peikarband.peikarband and src.* imports work correctly
+# REFLEX_DIR points to the directory containing rxconfig.py
 ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONPATH=/app \
+    PYTHONPATH=/app:/app/peikarband \
     PATH="/app/.venv/bin:$PATH" \
-    REFLEX_DIR=/app \
+    REFLEX_DIR=/app/peikarband \
     NODE_ENV=production
 
-# Health check
+# Diagnostic information
-HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
+RUN echo "=== Diagnostic Info ===" && \
-    CMD curl -f http://localhost:${PORT:-3000}/_health || exit 1
+    if [ -f /app/peikarband/.web/node_modules/.bin/react-router ]; then \
+        ls -la /app/peikarband/.web/node_modules/.bin/react-router && \
+        file /app/peikarband/.web/node_modules/.bin/react-router || true; \
+    fi && \
+    if [ -f /app/peikarband/.web/node_modules/@react-router/dev/bin.js ]; then \
+        head -5 /app/peikarband/.web/node_modules/@react-router/dev/bin.js || true; \
+    fi && \
+    echo "======================="
 
-# Switch to non-root user
+# Health check (using backend health endpoint on port 8000)
-USER peikarband
+HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
+    CMD curl -f http://localhost:8000/ping || exit 1
+
+# Running as root for now to avoid permission issues
+# USER peikarband
 
 # Expose port
 EXPOSE 3000 8000
 
 # Use tini as init system
-ENTRYPOINT ["/usr/bin/tini", "--"]
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint.sh"]
 
 # Start application
-CMD ["reflex", "run", "--env", "prod", "--loglevel", "info"]
+# entrypoint.sh will cd to /app/peikarband and run reflex
+# PYTHONPATH=/app:/app/peikarband allows Python to find both peikarband and peikarband.peikarband
+CMD ["run", "--env", "prod", "--loglevel", "info", "--frontend-port", "3000", "--backend-port", "8000"]
 
 # ============================================
 # Build Information
 # ============================================
-ARG GIT_COMMIT
+# ARG declarations are already done above in runtime stage
-ARG GIT_BRANCH
-ARG BUILD_NUMBER
-
 LABEL git.commit="${GIT_COMMIT}"
 LABEL git.branch="${GIT_BRANCH}"
 LABEL build.number="${BUILD_NUMBER}"

docker/Dockerfile copy

@@ -0,0 +1,51 @@
+# استفاده از ایمیج پایه‌ای که قبلاً Push کردید
+ARG BASE_IMAGE=hub.peikarband.ir/peikarband/landing:base
+FROM ${BASE_IMAGE} AS builder
+
+WORKDIR /app
+
+# ۱. کپی کردن فایل‌های نیازمندی (برای استفاده از Cache)
+COPY peikarband/requirements.txt .
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install --no-cache-dir -r requirements.txt
+
+# ۲. کپی کردن کل کدها
+# مهم: ساختار فولدر باید با app_name در rxconfig.py یکی باشد
+COPY peikarband/ .
+
+# ۳. تنظیم PYTHONPATH برای حل مشکل ModuleNotFoundError
+ENV PYTHONPATH=/app
+
+# ۴. اجرای Reflex Export
+# این دستور خودش فرانت‌تند را بیلد می‌کند و نیازی به npm run build دستی نیست
+RUN reflex init --loglevel debug
+RUN reflex export --frontend-only --no-zip --loglevel debug
+
+# ================= Stage 2: Runtime =================
+FROM ${BASE_IMAGE} AS runtime
+
+# ایجاد یوزر غیر ریشه برای امنیت
+RUN groupadd -r peikarband && useradd -r -g peikarband -u 1000 -m peikarband
+WORKDIR /app
+
+# کپی کردن کتابخانه‌های نصب شده از مرحله قبل
+COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
+
+# کپی کردن کد اپلیکیشن و فایلهای بیلد شده فرانت‌تند
+COPY --from=builder --chown=peikarband:peikarband /app /app
+
+# ایجاد پوشه‌های مورد نیاز
+RUN mkdir -p data logs uploaded_files && \
+    chown -R peikarband:peikarband /app && \
+    chmod -R 755 /app
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONPATH=/app \
+    NODE_ENV=production
+
+USER peikarband
+EXPOSE 3000 8000
+
+ENTRYPOINT ["/usr/bin/tini", "--"]
+CMD ["reflex", "run", "--env", "prod"]

docker/Dockerfile copy.base

@@ -0,0 +1,27 @@
+# Peikarband Base Image
+ARG PYTHON_VERSION=3.11
+FROM python:${PYTHON_VERSION}-slim
+
+# نصب ابزارهای سیستم و پاکسازی برای کاهش حجم
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc g++ make curl gnupg ca-certificates unzip git tini \
+    && rm -rf /var/lib/apt/lists/*
+
+# نصب Node.js 20
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/*
+
+# نصب Bun با مکانیزم Retry برای پایداری در شبکه
+RUN set -ex && \
+    for i in 1 2 3 4 5; do \
+        curl -fsSL https://bun.sh/install | bash && break || \
+        (echo "Attempt $i failed, retrying in 5 seconds..." && sleep 5); \
+    done
+ENV PATH="/root/.bun/bin:${PATH}"
+
+# آپدیت ابزارهای پایتون
+RUN pip install --no-cache-dir --upgrade pip setuptools wheel
+
+WORKDIR /build
+CMD ["/bin/bash"]

docker/entrypoint.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+set -e
+
+# Function to fix node_modules permissions
+fix_node_modules_permissions() {
+    if [ -d /app/peikarband/.web/node_modules/.bin ]; then
+        echo "Checking node_modules/.bin permissions..."
+        
+        REACT_ROUTER_BIN="/app/peikarband/.web/node_modules/.bin/react-router"
+        
+        # Check if react-router exists
+        if [ -e "$REACT_ROUTER_BIN" ]; then
+            # If it's a symlink, check and fix the target
+            if [ -L "$REACT_ROUTER_BIN" ]; then
+                TARGET=$(readlink -f "$REACT_ROUTER_BIN")
+                echo "react-router is a symlink pointing to: $TARGET"
+                if [ -f "$TARGET" ] && [ ! -x "$TARGET" ]; then
+                    echo "WARNING: Target file is not executable, attempting to fix..."
+                    chmod +x "$TARGET" 2>/dev/null || true
+                fi
+            fi
+            
+            # Fix permissions for react-router itself (file or symlink)
+            if [ ! -x "$REACT_ROUTER_BIN" ]; then
+                echo "WARNING: react-router is not executable, attempting to fix..."
+                chmod +x "$REACT_ROUTER_BIN" 2>/dev/null || true
+            fi
+            
+            # Fix all .bin files and their symlink targets
+            echo "Fixing permissions for all .bin files and symlink targets..."
+            find /app/peikarband/.web/node_modules/.bin -type f -exec chmod +x {} \; 2>/dev/null || true
+            find /app/peikarband/.web/node_modules/.bin -type l | while read symlink; do
+                target=$(readlink -f "$symlink" 2>/dev/null || true)
+                if [ -n "$target" ] && [ -f "$target" ]; then
+                    chmod +x "$target" 2>/dev/null || true
+                fi
+                chmod +x "$symlink" 2>/dev/null || true
+            done
+            
+            # Verify react-router is executable
+            if [ -x "$REACT_ROUTER_BIN" ]; then
+                echo "✅ react-router is executable"
+            else
+                echo "⚠️  WARNING: react-router may still not be executable (running as non-root)"
+            fi
+        else
+            echo "⚠️  WARNING: react-router binary not found (packages may not be installed yet)"
+        fi
+    else
+        echo "⚠️  WARNING: .web/node_modules/.bin directory not found (packages may not be installed yet)"
+    fi
+}
+
+# Change to the directory containing rxconfig.py
+cd /app/peikarband
+
+# If reflex run is being executed, ensure packages are installed first
+# This handles the case where .web directory doesn't exist from build time
+if [ "$1" = "run" ] && [ ! -d /app/peikarband/.web/node_modules ]; then
+    echo "Initializing Reflex (installing packages)..."
+    reflex init --loglevel info || true
+    echo "Packages installed, fixing permissions..."
+    fix_node_modules_permissions
+fi
+
+# Fix permissions if node_modules already exists (from build time or init)
+fix_node_modules_permissions
+
+# Run reflex with all passed arguments
+exec reflex "$@"
+

helm/peikarband/templates/deployment.yaml

@@ -34,6 +34,12 @@ spec:
           {{- toYaml .Values.securityContext | nindent 12 }}
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
+        {{- if .Values.command }}
+        command: {{- toYaml .Values.command | nindent 12 }}
+        {{- end }}
+        {{- if .Values.args }}
+        args: {{- toYaml .Values.args | nindent 12 }}
+        {{- end }}
         ports:
         - name: backend
           containerPort: {{ .Values.service.backend.targetPort }}
@@ -41,10 +47,7 @@ spec:
         - name: frontend
           containerPort: {{ .Values.service.frontend.targetPort }}
           protocol: TCP
-        livenessProbe:
+       
-          {{- toYaml .Values.livenessProbe | nindent 12 }}
-        readinessProbe:
-          {{- toYaml .Values.readinessProbe | nindent 12 }}
         resources:
           {{- toYaml .Values.resources | nindent 12 }}
         env:

helm/peikarband/templates/ingress.yaml

@@ -40,7 +40,7 @@ spec:
           {{- end }}
     {{- end }}
 {{- end }}
-
+---
 {{- if .Values.ingress.apiEnabled -}}
 # Backend API Ingress (api.peikarband.ir -> port 8000)
 apiVersion: networking.k8s.io/v1

helm/peikarband/values-production.yaml

@@ -17,7 +17,6 @@ registrySecret:
 imagePullSecrets:
   - name: hub-registry-secret
 
-# Auto-create application secrets (database, redis, etc)
 appSecrets:
   enabled: false  # Set to true if you need database/redis
   name: peikarband-prod-secrets
@@ -56,8 +55,6 @@ ingress:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
     traefik.ingress.kubernetes.io/router.tls: "true"
-    # Rate limiting and body size should be configured via Traefik Middleware
-    # Example: traefik.ingress.kubernetes.io/router.middlewares: default-ratelimit@kubernetescrd
   hosts:
     - host: peikarband.ir
       paths:
@@ -79,6 +76,8 @@ ingress:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
     traefik.ingress.kubernetes.io/router.tls: "true"
+    # Strip /api prefix if needed (currently not using prefix)
+    # traefik.ingress.kubernetes.io/rewrite-target: /
   apiHosts:
     - host: api.peikarband.ir
       paths:
@@ -118,10 +117,11 @@ readinessProbe:
   httpGet:
     path: /ping
     port: 8000
-  initialDelaySeconds: 60  # Allow Reflex to fully start (30-60s expected)
+    scheme: HTTP
+  initialDelaySeconds: 30  # Allow Reflex to fully start (build + startup takes time)
   periodSeconds: 10
-  timeoutSeconds: 5
+  timeoutSeconds: 5  # Increased timeout for slow responses
-  failureThreshold: 6  # Allow 6 failures = 60s grace period
+  failureThreshold: 5  # Allow 10 failures = 100s grace period
 
 # Override liveness probe
 # Using /live endpoint which is specifically designed for liveness checks
@@ -129,10 +129,11 @@ livenessProbe:
   httpGet:
     path: /live
     port: 8000
-  initialDelaySeconds: 90  # More time for liveness (after readiness)
+    scheme: HTTP
-  periodSeconds: 15
+  initialDelaySeconds: 30  # More time for liveness (after readiness + build)
-  timeoutSeconds: 5
+  periodSeconds: 10  # Check less frequently
-  failureThreshold: 3
+  timeoutSeconds: 5 # Increased timeout
+  failureThreshold: 5  # Allow more failures before restart
 
 configMap:
   data:

helm/peikarband/values.yaml

@@ -8,6 +8,17 @@ image:
   pullPolicy: IfNotPresent
   tag: "latest"
 
+# Build-time configuration (used during docker build)
+# Note: This is for documentation. Actual build uses Makefile NPM_REGISTRY variable
+# To override npm registry during build:
+#   make docker-build NPM_REGISTRY=https://your-npm-registry.com/
+build:
+  npmRegistry: "https://registry.npmjs.org/"  # Default npm registry URL
+  # Optional: Set if behind proxy (not needed for servers outside Iran)
+  # httpProxy: ""
+  # httpsProxy: ""
+  # noProxy: ""
+
 imagePullSecrets: []
 
 # Registry secret auto-creation (for private registry)
@@ -39,10 +50,12 @@ podAnnotations:
   prometheus.io/port: "8000"
   prometheus.io/path: "/metrics"
 
+# Running as root for now to avoid permission issues
+# TODO: Switch back to non-root user after permission issues are resolved
 podSecurityContext:
-  runAsNonRoot: true
+  runAsNonRoot: false
-  runAsUser: 1000
+  runAsUser: 0
-  fsGroup: 1000
+  fsGroup: 0
 
 securityContext:
   allowPrivilegeEscalation: false
@@ -93,11 +106,11 @@ ingress:
 
 resources:
   limits:
-    cpu: 1000m
+    cpu: 2
-    memory: 1Gi
+    memory: 2Gi
   requests:
-    cpu: 250m
+    cpu: 500m
-    memory: 512Mi
+    memory: 1Gi
 
 autoscaling:
   enabled: true
@@ -123,23 +136,31 @@ affinity:
                   - peikarband
           topologyKey: kubernetes.io/hostname
 
-livenessProbe:
+# livenessProbe:
-  httpGet:
+#   httpGet:
-    path: /ping
+#     path: /ping
-    port: 8000
+#     port: 8000
-  initialDelaySeconds: 30
+#     scheme: HTTP
-  periodSeconds: 10
+#   initialDelaySeconds: 50
-  timeoutSeconds: 5
+#   periodSeconds: 10
-  failureThreshold: 3
+#   timeoutSeconds: 5
+#   failureThreshold: 3
 
-readinessProbe:
+# readinessProbe:
-  httpGet:
+#   httpGet:
-    path: /ping
+#     path: /ping
-    port: 8000
+#     port: 8000
-  initialDelaySeconds: 10
+#     scheme: HTTP
-  periodSeconds: 5
+#   initialDelaySeconds: 60
-  timeoutSeconds: 3
+#   periodSeconds: 5
-  failureThreshold: 3
+#   timeoutSeconds: 3
+#   failureThreshold: 3
+
+# Container command and args
+# If command is set, it will override the Dockerfile CMD
+# If args is set, it will be appended to the command
+command: []  # Leave empty to use Dockerfile CMD, or set to override: ["/usr/local/bin/entrypoint.sh"]
+args: []     # Leave empty to use Dockerfile CMD args, or set: ["run", "--env", "prod"]
 
 env:
   - name: REFLEX_ENV
@@ -209,6 +230,12 @@ networkPolicy:
       - protocol: TCP
         port: 3000
   egress:
+    # Allow DNS resolution (required for all external connections)
+    - to: []
+      ports:
+      - protocol: UDP
+        port: 53    # DNS
+    # Allow internal cluster traffic (PostgreSQL, Redis, etc.)
     - to:
       - namespaceSelector: {}
       ports:
@@ -216,12 +243,14 @@ networkPolicy:
         port: 5432  # PostgreSQL
       - protocol: TCP
         port: 6379  # Redis
+    # Allow external internet access (npm registry, APIs, etc.)
+    # Empty 'to' selector means all destinations (including external)
+    - to: []
+      ports:
       - protocol: TCP
-        port: 443   # HTTPS
+        port: 443   # HTTPS (npm registry, APIs, etc.)
       - protocol: TCP
         port: 80    # HTTP
-      - protocol: UDP
-        port: 53    # DNS
 
 monitoring:
   serviceMonitor:

peikarband/.gitignore

@@ -0,0 +1,6 @@
+assets/external/
+*.py[cod]
+.states
+__pycache__/
+.web
+*.db

peikarband/app.py

@@ -0,0 +1,10 @@
+"""Peikarband Landing Application Entry Point.
+
+This file exports the Reflex app instance for the landing page.
+Reflex will look for 'app' in the root module when app_name matches the root directory.
+"""
+
+from src.presentation.web.pages.landing.index import app
+
+__all__ = ["app"]
+

peikarband/config/reflex.config.py

@@ -1,26 +0,0 @@
-"""Reflex configuration file.
-
-This file configures the Reflex application settings.
-"""
-
-import os
-import reflex as rx
-
-# Environment-aware configuration
-API_URL = os.getenv("API_URL", "http://localhost:8000")
-FRONTEND_PORT = int(os.getenv("FRONTEND_PORT", "3000"))
-BACKEND_PORT = int(os.getenv("BACKEND_PORT", "8000"))
-DB_URL = os.getenv("DATABASE_URL", "sqlite:///reflex.db")
-
-config = rx.Config(
-    app_name="peikarband",
-    api_url=API_URL,
-    frontend_port=FRONTEND_PORT,
-    backend_port=BACKEND_PORT,
-    db_url=DB_URL,
-    disable_plugins=["reflex.plugins.sitemap.SitemapPlugin"],
-    stylesheets=[
-        "https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800;900&display=swap",
-        "https://cdn.jsdelivr.net/gh/rastikerdar/vazirmatn@v33.003/Vazirmatn-font-face.css",
-    ],
-)

peikarband/peikarband/__init__.py

@@ -0,0 +1,8 @@
+"""Landing page app module.
+
+Reflex expects to find 'app' in peikarband.landing when app_name='landing'.
+"""
+
+from .peikarband import app
+
+__all__ = ["app"]

peikarband/peikarband/peikarband.py

@@ -0,0 +1,58 @@
+"""
+Peikarband Application Entry Point
+
+This is the main application file that Reflex uses to run the app.
+"""
+
+import reflex as rx
+from src.presentation.web.pages.landing.index import index
+from src.presentation.api.routes.health import (
+    ping_endpoint,
+    health_endpoint,
+    ready_endpoint,
+    live_endpoint,
+)
+
+# Create the app
+app = rx.App()
+
+# Add landing page
+app.add_page(index, route="/")
+
+# Add health check pages (for Kubernetes probes)
+# These return JSON responses for monitoring
+@rx.page(route="/ping")
+def ping():
+    """Basic health check endpoint"""
+    data = ping_endpoint()
+    return rx.box(
+        rx.text(str(data)),
+        style={"whiteSpace": "pre"}
+    )
+
+@rx.page(route="/health")
+def health():
+    """Detailed health check endpoint"""
+    data = health_endpoint()
+    return rx.box(
+        rx.text(str(data)),
+        style={"whiteSpace": "pre"}
+    )
+
+@rx.page(route="/ready")
+def ready():
+    """Readiness probe endpoint"""
+    data = ready_endpoint()
+    return rx.box(
+        rx.text(str(data)),
+        style={"whiteSpace": "pre"}
+    )
+
+@rx.page(route="/live")
+def live():
+    """Liveness probe endpoint"""
+    data = live_endpoint()
+    return rx.box(
+        rx.text(str(data)),
+        style={"whiteSpace": "pre"}
+    )

peikarband/rxconfig.py

@@ -18,6 +18,7 @@ config = rx.Config(
     frontend_port=FRONTEND_PORT,
     backend_port=BACKEND_PORT,
     db_url=DB_URL,
+    state_auto_setters=True,  # Temporary fix for 0.8.9+ deprecation warning
     disable_plugins=["reflex.plugins.sitemap.SitemapPlugin"],
     stylesheets=[
         "https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800;900&display=swap",

peikarband/src/__init__.py

@@ -0,0 +1,10 @@
+"""Peikarband Landing Application.
+
+This module exports the Reflex app instance for the landing page.
+"""
+
+# Import the app from the landing page module using relative import
+from .presentation.web.pages.landing.index import app
+
+__all__ = ["app"]
+

peikarband/src/presentation/web/pages/landing/index.py

@@ -1131,24 +1131,35 @@ def about_section() -> rx.Component:
                 padding="10px 24px",
                 border_radius="full",
             ),
-            rx.heading("زایای انتخاب پیکربند", size="9", color="white", font_weight="900", letter_spacing="-0.03em", margin_top="16px"),
+            rx.heading(
+                "مزایای انتخاب پیکربند", 
+                size=rx.breakpoints(initial="7", md="8", lg="9"),
+                color="white", 
+                font_weight="900", 
+                letter_spacing="-0.03em", 
+                margin_top="16px",
+                text_align="center",
+            ),
             rx.text(
                 "ارائه‌دهنده معتبر خدمات هاستینگ و زیرساخت ابری در ایران",
                 color="#94A3B8",
-                font_size="21px",
+                font_size=rx.breakpoints(initial="16px", md="18px", lg="20px"),
-                margin_bottom="80px",
+                margin_bottom=rx.breakpoints(initial="40px", md="60px", lg="80px"),
                 font_weight="500",
+                text_align="center",
             ),
-            rx.hstack(
+            rx.flex(
                 about_card("zap", "سرعت فوق‌العاده", "سرورهای بهینه‌شده با SSD NVMe و CDN جهانی برای بارگذاری آنی", "linear-gradient(135deg, #1B4B7F, #4F46E5)", "rgba(27, 75, 127, 0.5)"),
                 about_card("clock", "پشتیبانی 24/7", "تیم پشتیبانی حرفه‌ای و با تجربه، آماده کمک در هر لحظه", "linear-gradient(135deg, #4DB8C4, #7C3AED)", "rgba(77, 184, 196, 0.5)"),
                 about_card("shield-check", "امنیت پیشرفته", "SSL رایگان، بکاپ اتوماتیک روزانه و محافظت DDoS", "linear-gradient(135deg, #6DD7E5, #9333EA)", "rgba(109, 215, 229, 0.5)"),
-                spacing="9",
+                direction=rx.breakpoints(initial="column", lg="row"),
+                spacing=rx.breakpoints(initial="6", md="7", lg="9"),
                 width="100%",
+                align="stretch",
             ),
             max_width="1500px",
             margin="0 auto",
-            padding="140px 8%",
+            padding=rx.breakpoints(initial="80px 5%", md="110px 6%", lg="140px 8%"),
         ),
         background="linear-gradient(180deg, rgba(10, 18, 35, 0.98) 0%, rgba(5, 10, 20, 1) 100%)",
         width="100%",
@@ -1207,13 +1218,22 @@ def services_section() -> rx.Component:
                 padding="10px 24px",
                 border_radius="full",
             ),
-            rx.heading("همه چیز برای کسب‌وکار آنلاین شما", size="9", color="white", font_weight="900", letter_spacing="-0.03em", margin_top="16px"),
+            rx.heading(
+                "همه چیز برای کسب‌وکار آنلاین شما", 
+                size=rx.breakpoints(initial="7", md="8", lg="9"),
+                color="white", 
+                font_weight="900", 
+                letter_spacing="-0.03em", 
+                margin_top="16px",
+                text_align="center",
+            ),
             rx.text(
                 "از استارتاپ تا شرکت‌های بزرگ، راهکار مناسب برای هر کسب‌وکاری",
                 color="#94A3B8",
-                font_size="21px",
+                font_size=rx.breakpoints(initial="16px", md="18px", lg="20px"),
-                margin_bottom="80px",
+                margin_bottom=rx.breakpoints(initial="40px", md="60px", lg="80px"),
                 font_weight="500",
+                text_align="center",
             ),
             rx.grid(
                 service_card("وردپرس کلود", "کلود اختصاصی وردپرس با مدیریت هوشمند و پیشرفته", "cloud", ["نصب خودکار وردپرس", "مدیریت چند سایتی", "بکاپ اتوماتیک", "SSL رایگان", "بهینه‌سازی خودکار"], "#1B4B7F"),
@@ -1222,13 +1242,13 @@ def services_section() -> rx.Component:
                 service_card("DevOps حرفه‌ای", "اتوماسیون و مدیریت زیرساخت کلود", "code", ["Kubernetes", "Docker", "CI/CD Pipeline", "Infrastructure as Code"], "#1B4B7F"),
                 service_card("فروش دامین", "ثبت دامین‌های بین‌المللی و ایرانی", "tag", [".com, .ir, .net", "قیمت رقابتی", "تحویل فوری", "مدیریت DNS"], "#4DB8C4"),
                 service_card("پشتیبانی 24/7", "پشتیبانی تخصصی وردپرس و سرور", "headset", ["تیم متخصص", "پاسخگویی سریع", "مشاوره رایگان", "پشتیبانی فارسی"], "#6DD7E5"),
-                columns="3",
+                columns=rx.breakpoints(initial="1", sm="1", md="2", lg="3"),
-                spacing="9",
+                spacing=rx.breakpoints(initial="6", md="7", lg="9"),
                 width="100%",
             ),
             max_width="1500px",
             margin="0 auto",
-            padding="160px 8%",
+            padding=rx.breakpoints(initial="80px 5%", md="120px 6%", lg="160px 8%"),
         ),
         width="100%",
         id="services",
@@ -1690,23 +1710,31 @@ def footer() -> rx.Component:
     return rx.box(
         rx.vstack(
             rx.divider(background="rgba(27, 75, 127, 0.4)", margin_y="10"),
-            rx.hstack(
+            rx.flex(
                 rx.vstack(
                     rx.hstack(
                         rx.icon("cloud", size=32, color="#4DB8C4"),
-                        rx.heading("پیکربند", size="7", color="#4DB8C4", font_weight="900"),
+                        rx.heading(
+                            "پیکربند", 
+                            size=rx.breakpoints(initial="6", md="7"),
+                            color="#4DB8C4", 
+                            font_weight="900"
+                        ),
                         spacing="3",
+                        justify="center",
                     ),
                     rx.text(
                         "ارائه‌دهنده خدمات هاستینگ، دامین و زیرساخت ابری با کیفیت بالا و پشتیبانی 24/7",
                         color="#94A3B8",
-                        font_size="17px",
+                        font_size=rx.breakpoints(initial="15px", md="17px"),
                         line_height="1.7",
                         max_width="450px",
                         font_weight="500",
+                        text_align=rx.breakpoints(initial="center", lg="start"),
                     ),
                     spacing="5",
-                    align="start",
+                    align=rx.breakpoints(initial="center", lg="start"),
+                    width=rx.breakpoints(initial="100%", lg="auto"),
                 ),
                 rx.spacer(),
                 rx.hstack(
@@ -1762,22 +1790,27 @@ def footer() -> rx.Component:
                         color="#94A3B8",
                     ),
                     spacing="6",
+                    justify="center",
                 ),
+                direction=rx.breakpoints(initial="column", lg="row"),
                 width="100%",
                 align="center",
-                padding_y="40px",
+                justify=rx.breakpoints(initial="center", lg="between"),
+                spacing=rx.breakpoints(initial="8", lg="0"),
+                padding_y=rx.breakpoints(initial="30px", md="40px"),
             ),
             rx.divider(background="rgba(27, 75, 127, 0.3)", margin_y="8"),
             rx.text(
                 "© ۱۴۰۳ پیکربند. تمامی حقوق محفوظ است.",
                 color="#64748B",
-                font_size="16px",
+                font_size=rx.breakpoints(initial="14px", md="16px"),
                 font_weight="600",
                 padding_bottom="10",
+                text_align="center",
             ),
             max_width="1500px",
             margin="0 auto",
-            padding="60px 8% 40px",
+            padding=rx.breakpoints(initial="40px 5% 30px", md="50px 6% 35px", lg="60px 8% 40px"),
         ),
         width="100%",
         background="linear-gradient(180deg, rgba(10, 18, 35, 0.98) 0%, rgba(5, 10, 20, 1) 100%)",